Difference between revisions of "ISO"
(54 intermediate revisions by the same user not shown) | |||
Line 250: | Line 250: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD provided in June 2016 | *1st WD provided in June 2016 | ||
*2nd WD provided in May 2017 | |||
2nd WD provided in May 2017 | *3rd WD provided in November 2017 | ||
*4th WD provided in April 2018 | |||
3rd WD provided in November 2017 | *1st CD provided in November 2018 | ||
*2nd CD provided in October 2019 | |||
4th WD provided in April 2018 | *DIS published in October 2019 | ||
*FDIS publised in May 2020 | |||
1st CD provided in November 2018 | *Published in September 2020 | ||
2nd CD provided in October 2019 | |||
DIS published in October 2019 | |||
|- | |- | ||
Line 309: | Line 303: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD December 2015 | *1st WD December 2015 | ||
*2nd WD June 2016 | |||
2nd WD June 2016 | *1st CD Devember 2016 | ||
*2nd CD May 2017 | |||
1st CD Devember 2016 | *1st DIS January 2018 | ||
*FDIS August 2018 | |||
2nd CD May 2017 | *Published in November 2018 | ||
1st DIS January 2018 | |||
FDIS August 2018 | |||
Published in November 2018 | |||
|- | |- | ||
Line 349: | Line 337: | ||
| Calendar | | Calendar | ||
| | | | ||
Started in Paris October 2019 | *Started in Paris October 2019 | ||
*1st DTS published in July 2020, | |||
1st DTS published in July | *2nd DTS published in October 2020 | ||
*Publication in February 2021 | |||
2nd DTS published in October 2020 | *Further to the March 2022 meeting, a revision is underway, at CD level | ||
Publication in February 2021 | |||
Further to the March 2022 meeting, a revision is underway, at CD level | |||
|- | |- | ||
Line 387: | Line 371: | ||
| Comments | | Comments | ||
| | | | ||
*published in 2014 | |||
*Revision underway | |||
Revision underway | *Further to the April 2023 meeting, discussion is taking place for a revision | ||
Further to the April 2023, discussion is taking place for a revision | |||
|} | |} | ||
Line 411: | Line 393: | ||
| Calendar | | Calendar | ||
| | | | ||
<span style="line-height: 20.8px;">Started in Wuhan April 2018</span> | *<span style="line-height: 20.8px;">Started in Wuhan April 2018</span> | ||
*<span style="line-height: 20.8px;">1st WD provided in June 2018</span> | |||
<span style="line-height: 20.8px;">1st WD provided in June 2018</span> | *<span style="line-height: 20.8px;">2nd WD provided in November 2018</span> | ||
*<span style="line-height: 20.8px;">3rd WD provided in June 2019</span> | |||
<span style="line-height: 20.8px;">2nd WD provided in November 2018</span> | *<span style="line-height: 20.8px;">1st CD provided in December 2019</span> | ||
*<span style="line-height: 20.8px;">2nd CD provided in May 2020</span> | |||
<span style="line-height: 20.8px;">3rd WD provided in June 2019</span> | *<span style="line-height: 20.8px;">3rd CD provided in March 2021</span> | ||
*<span style="line-height: 20.8px;">DIS provided in April 2021</span> | |||
<span style="line-height: 20.8px;">1st CD provided in December 2019</span> | *<span style="line-height: 20.8px;">FDIS provided in January 2022</span> | ||
*<span style="line-height: 20.8px;">Published in June 2022</span> | |||
<span style="line-height: 20.8px;">2nd CD provided in May 2020</span> | |||
<span style="line-height: 20.8px;">3rd CD provided in March 2021</span> | |||
<span style="line-height: 20.8px;">DIS provided in April 2021</span> | |||
<span style="line-height: 20.8px;">FDIS provided in January 2022</span> | |||
<span style="line-height: 20.8px;">Published in June 2022</span> | |||
|- | |- | ||
| Comments | | Comments | ||
Line 460: | Line 433: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD | *1st WD provided in May 2020 | ||
*1st CD provided in November 2020 | |||
1st CD | *2nd CD provided in July 2021 | ||
*DIS provided in December 2022 | |||
2nd CD | *FDIS provided in October 2023 | ||
*Publication in November 2023 | |||
DIS | |||
FDIS | |||
Publication in November 2023 | |||
|- | |- | ||
Line 476: | Line 444: | ||
| Is a WG4 project. Delay between 2nd CD and DIS was due to discussions on requirements conformance (e.g. 27402 focuses on device requirements rather than device developer requirements) | | Is a WG4 project. Delay between 2nd CD and DIS was due to discussions on requirements conformance (e.g. 27402 focuses on device requirements rather than device developer requirements) | ||
|} | |} | ||
=== <span style="font-size: larger;">27550:2019 </span><span style="font-size: 18.252px; line-height: 21.9024px;">TR Privacy engineering for system lifecycle processes</span> === | === <span style="font-size: larger;">27550:2019 </span><span style="font-size: 18.252px; line-height: 21.9024px;">TR Privacy engineering for system lifecycle processes</span> === | ||
Line 502: | Line 471: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD provided in January 2017 | *1st WD provided in January 2017 | ||
*2nd WD provided in June 2017 | |||
2nd WD provided in June 2017 | *1st PDTR provided in January 2018 | ||
*2nd PDTR provided in June 2018 | |||
1st PDTR provided in January 2018 | *3rd PDTR provided in October 2018 | ||
*Version for publication provided in April 2019 | |||
2nd PDTR provided in June 2018 | *Publication in September 2019 | ||
3rd PDTR provided in October 2018 | |||
Version for publication provided in April 2019 | |||
Publication in September 2019 | |||
|- | |- | ||
Line 548: | Line 511: | ||
| Calendar<br/> | | Calendar<br/> | ||
| | | | ||
1st WD provided in April 2017 | *1st WD provided in April 2017 | ||
*2nd WD provided in Dec 2017 | |||
2nd WD provided in Dec 2017 | *3rd WD provided in July 2018 | ||
*4th WD provided in February 2019 | |||
3rd WD provided in July 2018 | *1st CD provided in October 2019 | ||
*DIS provided in November 2019 | |||
4th WD provided in February 2019 | *FDIS provided in September 2020 | ||
*Published in September 2021 | |||
1st CD provided in October 2019 | |||
DIS provided in November 2019 | |||
FDIS provided in September 2020 | |||
Published in September 2021 | |||
|- | |- | ||
Line 601: | Line 557: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD provided in March 2019 | *1st WD provided in March 2019 | ||
*2nd WD provided in June 2019 | |||
2nd WD provided in June 2019 | *1st CD provided in December 2019. Title changed (former title: establishing a PII deletion concept in organisations) | ||
*2nd CD was published in June 2020 | |||
1st CD provided in December 2019. Title changed (former title: establishing a PII deletion concept in organisations) | *DIS was provided in January 2021 | ||
*FDIS was provided in April 2021 | |||
2nd CD was published in June 2020 | *Publication in October 2021 | ||
DIS was provided in January 2021 | |||
FDIS was provided in April 2021 | |||
Publication in October 2021 | |||
|- | |- | ||
Line 634: | Line 584: | ||
| Calendar | | Calendar | ||
| | | | ||
Established in Gjovik (October 2018) | *Established in Gjovik (October 2018) | ||
*1st WD provided In June 2019 | |||
1st WD provided In June 2019 | *2nd WD provided in December 2019 | ||
*1st CD provided in May 2020 | |||
2nd WD provided in December 2019 | *2nd CD provided in October 2020 | ||
*3rd CD provided in April 2021 | |||
1st CD provided in May 2020 | *DIS provided in October 2021 | ||
*FDIS provided in May 2022 | |||
2nd CD provided in October 2020 | *Publication in October 2022 | ||
3rd CD provided in April 2021 | |||
DIS provided in October 2021 | |||
FDIS provided in May 2022 | |||
Publication in October 2022 | |||
|- | |- | ||
Line 683: | Line 625: | ||
| Calendar | | Calendar | ||
| | | | ||
*1st WD was published in May 2020 | |||
*2nd WD was published in October 2020 | |||
2nd WD was published in October 2020 | *1st CD was published in April 2021 | ||
*DIS was provided in October 2021 | |||
1st CD was published in April 2021 | *FDIS was provided in June 2022 | ||
*Published in November 2022 | |||
DIS was provided in October 2021 | |||
FDIS was provided in June 2022 | |||
Published in November 2022 | |||
|} | |} | ||
Line 715: | Line 652: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD was provided in July 2020 | *1st WD was provided in July 2020 | ||
*2nd WD was provided in February 2021 | |||
2nd WD was provided in February 2021 | *1st CD was prrovided in April 2021 | ||
*DIS was provided in October 2021 | |||
1st CD was prrovided in April 2021 | *FDIS was provided in June 2022 | ||
*Published in November 2022 | |||
DIS was provided in October 2021 | |||
FDIS was provided in June 2022 | |||
Published in November 2022 | |||
|} | |} | ||
Line 752: | Line 684: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD was provided in May 2020 | *1st WD was provided in May 2020 | ||
*2nd WD was provided in January 2021 | |||
*3rd WD was provided in April 2021 | |||
*4th WD was provided in October 2021 | |||
*5th WD was provided in June 2022 | |||
*DTS was provided in October 2022 | |||
*Publication in August 2023 | |||
|} | |||
=== <span style="font-size: larger;">27561:2024 IS POMME Privac</span><span style="font-size: larger;">y operationalization model and method for engineering</span> === | |||
=== <span style="font-size: larger;">27561 IS POMME Privac</span><span style="font-size: larger;">y operationalization model and method for engineering</span> === | |||
<div> | <div> | ||
{| cellpadding="1" cellspacing="1" border="1" style="line-height: 20.8px; width: 900px;" | {| cellpadding="1" cellspacing="1" border="1" style="line-height: 20.8px; width: 900px;" | ||
Line 829: | Line 756: | ||
| Calendar | | Calendar | ||
| | | | ||
<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Established in October 2021</span> | *<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Established in October 2021</span> | ||
*<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Draft TR was provided in December 2021</span> | |||
<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Draft TR was provided in December 2021</span> | *<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Further to March 2022 meeting, title is changed from ''Impact of security and privacy in AI use cases'' to ''security and privacy in AI use cases'', and 2nd Draft TR was provided in May 2022</span> | ||
*<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">3rd draft DTR was provided in September 2022</span> | |||
<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Further to March 2022 meeting, title is changed from ''Impact of security and privacy in AI use cases'' to ''security and privacy in AI use cases'', and 2nd Draft TR was provided in May 2022</span> | *<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Further to April 2023 meeting, publication was mede in May 2023</span> | ||
<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">3rd draft DTR was provided in September 2022</span> | |||
<span style="color: rgb(37, 37, 37); font-family: sans-serif; font-size: 14px;">Further to April 2023 meeting, publication was mede in May 2023</span> | |||
|- | |- | ||
Line 866: | Line 789: | ||
| Calendar | | Calendar | ||
| | | | ||
<span style="line-height: 20.8px;">1st WD was provided in June 2018 further the Wuhan meeting.</span> | *<span style="line-height: 20.8px;">1st WD was provided in June 2018 further the Wuhan meeting.</span> | ||
*<span style="line-height: 20.8px;">2nd WD was provided in October 2018 further to the Gjovik meeting.</span> | |||
<span style="line-height: 20.8px;">2nd WD was provided in October 2018 further to the Gjovik meeting.</span> | *<span style="line-height: 20.8px;">A 1st PDTS was provided in May 2019 further to the Tel Aviv meeting.</span> | ||
*<span style="line-height: 20.8px;">A 2nd PDTS was provided in November 2019 further to the Paris meeting</span> | |||
<span style="line-height: 20.8px;">A 1st PDTS was provided in May 2019 further to the Tel Aviv meeting.</span> | *<span style="line-height: 20.8px;">A 3rd PDTS was provided in May 2020 further to the April 2020 virtual meeting</span> | ||
*<span style="line-height: 20.8px;">The document will go to publication further to the September 2020 virtual meeting.</span> | |||
<span style="line-height: 20.8px;">A 2nd PDTS was provided in November 2019 further to the Paris meeting</span> | *<span style="line-height: 20.8px;">The standard was published in January 2021 see following press release: </span>[https://www.iso.org/news/ref2631.html https://www.iso.org/news/ref2631.html] | ||
<span style="line-height: 20.8px;">A 3rd PDTS was provided in May 2020 further to the April 2020 virtual meeting</span> | |||
<span style="line-height: 20.8px;">The document will go to publication further to the September 2020 virtual meeting.</span> | |||
<span style="line-height: 20.8px;">The standard was published in January 2021 see following press release: </span>[https://www.iso.org/news/ref2631.html https://www.iso.org/news/ref2631.html] | |||
|- | |- | ||
Line 914: | Line 831: | ||
| Calendar | | Calendar | ||
| | | | ||
1st WD provided in April 2017 | *1st WD provided in April 2017 | ||
*2nd WD provided in June 2017 | |||
2nd WD provided in June 2017 | *1st CD provided in April 2018 | ||
*2nd CD provided in June 2018 | |||
1st CD provided in April 2018 | *DIS provided in March 2019 | ||
*Publication in August 2019 | |||
2nd CD provided in June 2018 | *A revision has been initiated in 2022-10 | ||
*Further to April 2023 mode, a Final Draft International Standard (FDIS) will be provided | |||
DIS provided in March 2019 | |||
Publication in August 2019 | |||
A revision has been initiated in 2022-10 | |||
Further to April 2023 mode, a Final Draft International Standard (FDIS) will be provided | |||
|- | |- | ||
Line 934: | Line 844: | ||
| | | | ||
Was initially ISO/IEC 27552. Was renamed to ISO/IEC 27701 in August 2019 | Was initially ISO/IEC 27552. Was renamed to ISO/IEC 27701 in August 2019 | ||
A second version is underway with a title change: Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance | |||
|} | |} | ||
Line 945: | Line 857: | ||
<span style="line-height: 20.7999992370605px">Stefan Weiss</span> | <span style="line-height: 20.7999992370605px">Stefan Weiss</span> | ||
<span style="line-height: 20.7999992370605px">Revision : Nat Sakimura</span> | <span style="line-height: 20.7999992370605px">Revision : Nat Sakimura, Jan Schallaboeck</span> | ||
|- | |- | ||
Line 956: | Line 868: | ||
| Comments | | Comments | ||
| | | | ||
*Revision published in February 2024 | |||
|} | |} | ||
Line 1,052: | Line 960: | ||
|- | |- | ||
| Calendar | | Calendar | ||
| Published in August 2017 | | | ||
*Published in August 2017 | |||
*PWI 8888 to prepare revision in March 2023 | |||
*1st CD of revision provided in October 2023 | |||
*2nd CD of revision to be provided in Apri 2924 | |||
|- | |- | ||
| Comments | | Comments | ||
Line 1,079: | Line 989: | ||
| style="background-color: transparent; cursor: text; line-height: 20.8px; margin: 0px;" | Calendar | | style="background-color: transparent; cursor: text; line-height: 20.8px; margin: 0px;" | Calendar | ||
| style="background-color: transparent; cursor: text; line-height: 20.8px; margin: 0px;" | | | style="background-color: transparent; cursor: text; line-height: 20.8px; margin: 0px;" | | ||
1st WD provided in June 2016 | *1st WD provided in June 2016 | ||
*2nd WD provided in April 2017 | |||
2nd WD provided in April 2017 | *3rd WD provided in June 2017 | ||
*1nd CD provided in December 2017 | |||
3rd WD provided in June 2017 | *<span style="line-height: 20.8px;">2nd CD provided in July 2018</span> | ||
*<span style="line-height: 20.8px;">3rd CD provided in January 2019</span> | |||
1nd CD provided in December 2017 | *<span style="line-height: 20.8px;">DIS provided in April 2019</span> | ||
*<span style="line-height: 20.8px;">FDIS provided in May 2020</span> | |||
<span style="line-height: 20.8px;">2nd CD provided in July 2018</span> | *<span style="line-height: 20.8px;">Published in June 2020</span> | ||
<span style="line-height: 20.8px;">3rd CD provided in January 2019</span> | |||
<span style="line-height: 20.8px;">DIS provided in April 2019</span> | |||
<span style="line-height: 20.8px;">FDIS provided in May 2020</span> | |||
<span style="line-height: 20.8px;">Published in June 2020</span> | |||
|- style="background-color: transparent; cursor: text; line-height: 20.8px; margin: 0px;" | |- style="background-color: transparent; cursor: text; line-height: 20.8px; margin: 0px;" | ||
Line 1,158: | Line 1,060: | ||
| Comments<br/> | | Comments<br/> | ||
| | | | ||
Published in December 2012 | *Published in December 2012 | ||
*Minor revision for FDIS in July 2024 | |||
|} | |||
=== <span style="font-size: larger;">31700-1:2023 IS Consumer Protection - Privacy-by-design for consumer goods and services - High level requirements</span> === | === <span style="font-size: larger;">31700-1:2023 IS Consumer Protection - Privacy-by-design for consumer goods and services - High level requirements</span> === | ||
Line 1,289: | Line 1,190: | ||
| Comments | | Comments | ||
| Follow-up of [https://ipen.trialog.com/wiki/Completed_study_periods_and_pwis#PWI_5181_Information_technology_-_Security_and_privacy_-_Data_provenance_.28Started_in_September_2020.2C_Completed_in_October_2022.29 PWI 5181 Data provenance] | | Follow-up of [https://ipen.trialog.com/wiki/Completed_study_periods_and_pwis#PWI_5181_Information_technology_-_Security_and_privacy_-_Data_provenance_.28Started_in_September_2020.2C_Completed_in_October_2022.29 PWI 5181 Data provenance] | ||
2nd | *1st WD provided in March 2023 | ||
*2nd WD provided in August 2023 | |||
*3rd WD provided in December 2023 | |||
|} | |} | ||
Line 1,360: | Line 1,226: | ||
*1st WD provided in May 2023 | *1st WD provided in May 2023 | ||
*2nd WD provided in October 2023 | *2nd WD provided in October 2023 | ||
*3rd WD provided in April 2024 | *3rd WD to be provided in April 2024 | ||
|} | |} | ||
Line 1,385: | Line 1,251: | ||
Started in Paris October 2018 with a preliminary version | Started in Paris October 2018 with a preliminary version | ||
*1st WD provided in October 2019 | |||
*2nd WD provided in May 2020 | |||
*3rd WD provided in March 2021 | |||
*4th WD provided in April 2021 | |||
*5th WD provided in May 2021 | |||
*6th WD provided in July 2021 | |||
*1st CD provided in January 2022 | |||
*2nd CD provided in June 2022 | |||
*DIS provided in October 2022 | |||
*2nd DIS provided in April 2023 | |||
*FDIS provided in January 2024 | |||
FDIS provided in January | |||
|- | |- | ||
Line 1,440: | Line 1,296: | ||
*2nd CD provided in May 2023 | *2nd CD provided in May 2023 | ||
*DIS provided in November 2023 | *DIS provided in November 2023 | ||
*FDIS | *FDIS to be provided in April 2024 | ||
|- | |- | ||
Line 1,468: | Line 1,324: | ||
| Calendar | | Calendar | ||
| | | | ||
*Established in October 2021 | |||
*1st WD provided in June 2022 | |||
*2nd WD provided in November 2022 | |||
*3rd WD provided in May 2023 | |||
*1st CD provided in December 2023 | |||
*2nd CD to be provided in May 2024 | |||
|- | |- | ||
| Comments | | Comments | ||
Line 1,487: | Line 1,341: | ||
<span style="font-size: larger;"></span> | <span style="font-size: larger;"></span> | ||
=== <span style="font-size: larger;">27566 IS Age assurance - Framework</span> === | === <span style="font-size: larger;">27566-1 IS Age assurance - Part 1: Framework</span> === | ||
{| cellpadding="1" cellspacing="1" border="1" style="font-size: 13px; line-height: 20.8px; width: 900px;" | {| cellpadding="1" cellspacing="1" border="1" style="font-size: 13px; line-height: 20.8px; width: 900px;" | ||
Line 1,493: | Line 1,347: | ||
| Leaders | | Leaders | ||
| | | | ||
Tony Allen | Tony Allen, Denis Pinkas, Mark Svancarek | ||
|- | |- | ||
| Scope | | Scope | ||
| | | | ||
This document establishes core principles, including privacy, for the purpose of enabling age related eligibility decisions | This document establishes core principles, including privacy and security, for the purpose of enabling age-related eligibility decisions | ||
|- | |- | ||
| Documentation | | Documentation | ||
| https://www.iso.org/standard/ | | https://www.iso.org/standard/88143.html | ||
|- | |- | ||
| Calendar | | Calendar | ||
| | | | ||
Started in | *Started in May 2023 | ||
*1st WD provided in December 2023 | |||
1st | *2nd WD provided in March 2024 | ||
*1st CD to be provided in May 2024 | |||
|- | |- | ||
Line 1,515: | Line 1,369: | ||
It the result of [https://ipen.trialog.com/wiki/Completed_study_periods_and_pwis#PWI_7732_Age_verification_.28Started_in_April_2021.2C_completed_in_October_2022.29 PWI 7732 Age verification] | It the result of [https://ipen.trialog.com/wiki/Completed_study_periods_and_pwis#PWI_7732_Age_verification_.28Started_in_April_2021.2C_completed_in_October_2022.29 PWI 7732 Age verification] | ||
|} | |||
<div class="_"></div> | |||
<span style="font-size: larger;"></span> | |||
=== <span style="font-size: larger;">27566 IS Age assurance - Part 3: Benchmarks for benchmarking analysis</span> === | |||
{| cellpadding="1" cellspacing="1" border="1" style="font-size: 13px; line-height: 20.8px; width: 900px;" | |||
|- | |||
| Leaders | |||
| | |||
Tony Allen, Denis Pinkas, Mark Svancarek | |||
|- | |||
| Scope | |||
| | |||
This document provides guidelines for interoperability, technical architecture and use of age assurance | |||
systems. | |||
* | |- | ||
| Documentation | |||
| https://www.iso.org/standard/88147.html | |||
|- | |||
| Calendar | |||
| | |||
*Started in October 2023 | |||
*1st WD provided in December 2023 | |||
*2ne WD to be provided in May 2024 | |||
|- | |||
| Comments | |||
| | |||
It the result of [https://ipen.trialog.com/wiki/Completed_study_periods_and_pwis#PWI_7732_Age_verification_.28Started_in_April_2021.2C_completed_in_October_2022.29 PWI 7732 Age verification] | |||
|} | |} | ||
<div class="_"></div> | <div class="_"></div> | ||
<span style="font-size: larger;"></span> | <span style="font-size: larger;"></span> | ||
=== <span style="font-size: larger;">27706 IS Requirements for bodies providing audit and certification of privacy information management systems</span> === | |||
{| cellpadding="1" cellspacing="1" border="1" style="line-height: 20.8px; width: 900px;" | |||
|- | |||
| Editor | |||
| Kimberly Lucy, Fuki Azetsu, Gigi Robinson | |||
|- | |||
| Scope | |||
| | |||
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006-1. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. | |||
The requirements contained in this document need to be demonstrated in terms of competence and reliability by any body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification. | |||
NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes. | |||
|- | |||
| Documentation | |||
| [https://www.iso.org/standard/82894.html https://www.iso.org/standard/82894.html]<br/> | |||
|- | |||
| Calendar | |||
| | |||
*1st CD was provided in May 2022 | |||
*2nd CD was provided in November 2022 | |||
*DIS was provided in May 2023 | |||
*Further to October 2023 meeting, document is being restructured | |||
|- | |||
| Comments | |||
| | |||
Follow-up of ISO/IEC 27006-2 TS | |||
| <br/> | |||
|} | |||
== Active Preliminary Work Items == | == Active Preliminary Work Items == | ||
Line 1,558: | Line 1,470: | ||
* 4th PWI in March 2022 | * 4th PWI in March 2022 | ||
* 5th PWI in June 2022 | * 5th PWI in June 2022 | ||
* Proposal for new project in February 2023 | |||
* Further to proposal PWI is restarted in April 2023 | |||
|- | |- | ||
| Comments | | Comments | ||
Line 1,603: | Line 1,518: | ||
|} | |} | ||
=== <span style="font-size: medium;">PWI 27046 Big data security and privacy - Implementation guidelines (restarted in April 2023)</span> === | === <span style="font-size: medium;">PWI 27046 Big data security and privacy - Implementation guidelines (restarted in April 2023)</span> === | ||
Line 1,620: | Line 1,536: | ||
| Calendar | | Calendar | ||
| | | | ||
*1st WD was provided in October 2019 | |||
*2nd WD was provided in June 2020 | |||
2nd WD was provided in June 2020 | *3rd WD was provided in November 2020 | ||
*4th WD was provided in April 2021 | |||
3rd WD was provided in November 2020 | *5th WD was provided in April 2022 | ||
*1st CD was provided in October 2022 | |||
4th WD was provided in April 2021 | *Further to April 2023 meeting, this project will be reverted to preliminary work item (PWI) | ||
5th WD was provided in April 2022 | |||
1st CD was provided in October 2022 | |||
Further to April 2023 meeting, this project will be reverted to preliminary work item (PWI) | |||
|- | |- | ||
| Comments | | Comments | ||
Line 1,678: | Line 1,586: | ||
*A report was provided at the April 2023 meeting. | *A report was provided at the April 2023 meeting. | ||
*A | *A 2nd report was provided at the October 2023 meeting | ||
*A proposal for a technical specification is underway | *A proposal for a technical specification is underway | ||
Line 1,684: | Line 1,592: | ||
|} | |} | ||
</div> | </div> | ||
=== <span style="font-size: medium;">27566 IS Age assurance - Part 2: Interoperability, technical architecture and guidelines for use</span> === | |||
{| cellpadding="1" cellspacing="1" border="1" style="font-size: 13px; line-height: 20.8px; width: 900px;" | |||
|- | |||
| Leaders | |||
| | |||
Tony Allen, Denis Pinkas, Mark Svancarek | |||
|- | |||
| Scope | |||
| | |||
This document provides guidelines for interoperability, technical architecture and use of age assurance | |||
systems. | |||
|- | |||
| Documentation | |||
| | |||
|- | |||
| Calendar | |||
| | |||
*Started in November 2023 | |||
*1st PWI text provided in December 2023 | |||
*2nd PWI text provided in March 2024 | |||
|- | |||
| Comments | |||
| | |||
It the result of [https://ipen.trialog.com/wiki/Completed_study_periods_and_pwis#PWI_7732_Age_verification_.28Started_in_April_2021.2C_completed_in_October_2022.29 PWI 7732 Age verification] | |||
|} | |||
<div class="_"></div> | |||
<span style="font-size: larger;"></span> | |||
=== <span style="font-size: medium;">PWI 27568 Security and privacy of digital twins (Started in October 2022)</span> === | === <span style="font-size: medium;">PWI 27568 Security and privacy of digital twins (Started in October 2022)</span> === | ||
Line 1,719: | Line 1,659: | ||
|} | |} | ||
</div> | </div> | ||
=== <span style="font-size: medium;">Privacy protection of user avatar and system avatar interactions in the metaverse)</span> === | === <span style="font-size: medium;">PWI 27573 Privacy protection of user avatar and system avatar interactions in the metaverse (Started in October 2024)</span> === | ||
<div> | <div> | ||
{| cellpadding="1" cellspacing="1" border="1" style="line-height: 20.8px; width: 900px;" | {| cellpadding="1" cellspacing="1" border="1" style="line-height: 20.8px; width: 900px;" | ||
Line 1,751: | Line 1,691: | ||
Started in April 2024 | Started in April 2024 | ||
|- | |- |
Latest revision as of 17:04, 11 May 2024
Introduction
The objective of this page is to provide a high-level view of activities related to privacy standards in ISO. It does not cover security standards (but it does cover standards that cover both security and privacy).
Most projects are developed within ISO/IEC JTC1/SC27. More info can be found on in the SC27 portal:
- http://www.jtc1sc27.din.de/cmd?level=tpl-home&languageid=en
- http://www.jtc1sc27.din.de/cmd?level=tpl-bereich&menuid=220707&languageid=en&cmsareaid=220707 (set of slides)
Note that the portal will in general contain more information than this wiki, which focuses mainly on work carried out in ISO/IEC JTC1/SC27/WG5.The convenor is Kai Rannenberg, and the vice convenor is Jan Schallaböck. WG5 regularly publishes a document a standing document (SG1) on WG5 roadmap. It can be found in [1]
Some of the projects are also carried out in ISO/IEC JTC1/SC27/WG4.The convenor is Johann Amsenga, and the vice convenor is François Lorek
One project is carried out within ISO PC317. The convenor is Jan Schallaböck. ISO PC317 focuses on the development of ISO 31700 (Consumer protection: privacy by design for consumer goods and services)
Some conventions on ISO standards
The important things to know concerning ISO standards steps:
Standard |
|
Technical report |
|
Technical specification |
|
Meetings
Progress is finalised in plenary meetings (taking place every 6 months).
Here is a list of meetings that took place or that will take place in SC27.
2014 |
|
2015 |
|
2016 |
|
2017 |
|
2018 |
|
2019 |
|
2020 |
|
2021 |
|
2022 |
|
2023 |
|
2024 |
|
ISO 31700 is dealt with in another committee (PC317). Here is a list of meetings that took place or that will take place in PC317.
2018 |
|
2019 |
|
2020 |
|
2021 |
|
2022 |
|
Privacy references lists
Scope |
The WG5 Standing Document 2 contains references with relevant descriptions to privacy-related:
The WG5 Standing Document 2 shall not be considered as:
|
Documentation | https://www.din.de/resource/blob/78924/5ced65e40dcbe6e503c2392c75f3dd1e/sc27wg5-sd2-data.pdf |
Calendar |
This document is regularly updated |
Published standards
19608:2018 TS Guidance for developing security and privacy functional requirements based on 15408
Editor |
Naruki Kai |
Scope |
This Technical Report provides guidance for:
|
Documentation | https://www.iso.org/standard/65459.html |
Calendar |
has been moved from TR to TS Published in October 2018 |
Comments |
20547-4:2020 IS Big data reference architecture - Part 4 - Security and privacy
Editor | Jinhua Min, Xuebin Zhou |
ScopeS | Specifies security and privacy aspects of the big data reference architecture including governance, collection, processing, exchange, storage and identification |
Documentation |
Is the follow-up of the NIST initiative for a big data interoperability framework. Reports are available there: [1], [2], [3], [4], [5], [6], [7] |
Calendar |
|
Comments |
WG9 is working on the following
Part 4 is transferred to SC27 for development, with close liaison with WG 9 [Antonio Kung] The 20547 reference architecture should be instantiated into domain specific real architectures (e.g. health, transport, energy...). 20547-4 should therefore
Further to Berlin meeting, decision to change title (term fabric is removed) |
20889:2018 IS Privacy enhancing de-identification terminology and classification of techniques
Editor |
Chris Mitchell and Lionel Vodzislawsky |
Scope | This international standard provides a description of privacy enhancing data de-identification techniques, to be used for describing and designing de-identification measures in accordance with the privacy principles in ISO/IEC 29100. In particular, this International Standard specifies terminology, a classification of de-identification techniques according to their characteristics, and their applicability for minimizing the risk of re-identification |
Documentation |
Slides presented by Chris Mitchel during IPEN workshop (June 5th 2015): http://ipen.trialog.com/wiki/File:CM_slide_for_150605.pdf |
Calendar |
|
Comments |
27006-2:2021 TS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems
Editor | Helge Kreutzmann, Fuki Azetsu, Hans Hedbom, Alan Shipman |
Scope |
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. Conformance to the requirements contained in this document needs to be demonstrated in terms of competence and reliability by certification body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for certification body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes. |
Documentation | https://www.iso.org/standard/71676.html |
Calendar |
|
Comments |
27018:2014 - Revision underway - IS Code of practice for protection of PII in public clouds acting as PII processors
Editor |
Revision: Ramaswamy Chandramouli, Hendrik Decroos |
Scope |
This International Standard establishes control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. It specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which might be applicable within the context of the information security risk environment(s) of a provider of public cloud services. The standard concerns public cloud only and cloud service providers acting as PII processors. |
Documentation | |
Comments |
|
27400:2022 IS Security and Privacy for the Internet of Things
Editor |
Faud Khan, Koji Nakao, Luc Poulin, Antonio Kung (initial stages) |
Scope |
This document provides guidelines on risks, principles and controls for security and privacy of Internet of Things (IoT). |
Documentation | https://www.iso.org/standard/44373.html |
Calendar |
|
Comments |
Follow up of
Aprll 2020: Renamed from 27030 to 27400 |
27402:2023 IS IoT security and privacy - Device baseline requirements
Editor | Elaine Newton, Amit Elazari Bar On, Faud Khan |
Scope |
This document provides baseline ICT requirements for IoT devices to support security and privacy controls |
Documentation | https://www.iso.org/standard/80136.html |
Calendar |
|
Comments | Is a WG4 project. Delay between 2nd CD and DIS was due to discussions on requirements conformance (e.g. 27402 focuses on device requirements rather than device developer requirements) |
27550:2019 TR Privacy engineering for system lifecycle processes
Editor |
Antonio Kung, Mathias Reinis |
Scope |
This technical report provides privacy engineering guidelines that are intended to help organisations integrate recent advances in privacy engineering into their engineering practices:
The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of systems that need privacy consideration, as well as managers in organisations responsible for privacy, development, product management, marketing, and operations |
Documentation |
A youtube presentation on privacy engineering: https://www.youtube.com/watch?v=BymNvbmSr2E |
Calendar |
|
Comments |
[Antonio Kung]
|
27551:2021 IS Requirements for attribute-based unlinkable entity authentication
Editor |
Nat Sakimura, Jaehoon Na, Pascal Pailler |
Scope |
This International Standard
This International Standard is applicable to any information system that performs attribute-based unlinkable entity authentication |
Documentation | https://www.iso.org/standard/44373.html |
Calendar |
|
Comments |
27555:2021 IS Guidelines on Personally Identifiable Information Deletion
Editor |
Dorotea Alessandra de Marco, Yan Sun, Volker Hammer |
Scope |
This document specifies the conceptual framework for deletion of PII. It gives guidelines for establishing organizational policies that embrace concepts presented by specifying:
This document is intended to be used by organizations where PII and other personal data is being stored or processed. This document does not address:
|
Documentation | https://www.iso.org/fr/standard/71673.html |
Calendar |
|
Comments | It is based on a German standard |
27556:2022 IS User-centric privacy preferences management framework
Editor |
Shinsaku Kiyomoto, Antonio Kung, Heung Youl Youm |
Scope |
This document provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences. |
Calendar |
|
Documentation | https://www.iso.org/standard/71674.html |
Comments | Project named changed from "User-centric framework for the handling of personally identifiable information (PII) based on privacy preferences" to "User-centric privacy preferences management framework" |
27557:2022 IS Organizational privacy risk management
Editor |
Kimberly Lucy, Markus Gierschmann, Kelvin Magtalas, Carlo Harpes |
Scope |
Provides guidelines for organizational privacy risk management. Designed to provide guidance to organizations processing personally identifiable information (PII) for integrating risks to the organization related to the processing of PII, including the privacy impact to individuals, as part of an organizational privacy risk management program. Assists in the implementation of a risk-based privacy program which can be integrated in the overall risk management of the organization, and supports the requirement for risk management as specified in management systems (such as ISO/IEC 27701:2019). |
Documentation | https://www.iso.org/standard/71674.html |
Calendar |
|
27559:2022 IS Privacy-enhancing data de-identification framework
Editor | Malcolm Townsend, Santa Borel |
Scope |
This document provides a framework for identifying and mitigating re-identification risks and risks associated with the lifecycle of de-identified data. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations implementing data de-identification processes for privacy enhancing purposes. |
Documentation | https://www.iso.org/standard/71677.html |
Calendar |
|
27560:2023 TS Privacy technologies – Consent record information structure
Editor | Jan LIndquist, Andrew Hughes, Kelvin Magtalas |
Scope |
This document specifies an interoperable, open and extensible information structure for recording PII Principals' or data subjects' consent to data processing. This document further provides guidance on the use of consent receipts and consent records associated with a PII Principal's data processing consent to support the: — provision of a record of the consent to the PII Principal; — exchange of consent information between information systems; and, — management of the lifecycle of the recorded consent. |
Documentation | https://www.iso.org/standard/80392.html |
Calendar |
|
27561:2024 IS POMME Privacy operationalization model and method for engineering
Leaders | John Sabo, Antonio Kung, Srinivas Poorsala, Dorotea Alessandra de Marco, Aswathy KUMAR , Michele Drgon; |
Objective |
This document describes a model and method to operationalize privacy principles into sets of controls and functional capabilities.
|
Documentation | https://www.iso.org/standard/80394.html |
Calendar |
|
Comments |
It the result of the study period privacy engineering model It is based on OASIS-PMRM http://docs.oasis-open.org/pmrm/PMRM/v1.0/cs02/PMRM-v1.0-cs02.html |
27563:2023 TR Security and privacy in artificial intelligence use cases - Best practices
Leaders | Antonio Kung, Peter Dickman, Heung Youl Youm, Yunwei Zhao, Volker Smoljko, Kelvin Magtalas, Srinivas Poorsala |
Objective |
This document provides information on how to assess the impact of security and privacy in AI use cases, covering in particular those published in ISO/IEC TR 24030 (Information technology – Artificial Intelligence (AI) – use cases) |
Documentation | https://www.iso.org/standard/80396.html
ISO/IEC 24030 covers 132 use cases that are described here: https://standards.iso.org/iso-iec/tr/24030/ed-1/en/Use+cases-v05_electronic_attachment_022021.pdf ISO/IEC 27563 covers the security of privacy of the 132 use cases, described here: https://standards.iso.org/iso-iec/tr/27563/ed-1/en/Security-privacy-AI-use-cases.pdf |
Calendar |
|
Comments |
It is the result of phase 1 of PWI 6089 Impact of AI on security and privacy |
27570:2021 TS Privacy Guidelines for Smart Cities
Editor | Antonio Kung, Heung Youl Youm, Clotilde Cochinaire |
Scope |
The document takes into account a multiple agency as well as a citizen centric viewpoint, and provides guidance on how privacy standards can be used at a global level and at an organisational level for the benefit of citizens This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that provides service in the smart city environments |
Documentation | https://www.iso.org/standard/71678.html |
Calendar |
|
Comments |
First ecosystem oriented standard for privacy Follow up of SP Privacy in Smart cities Liaison will take place with WG11 (smart cities), SC40 (IT Service Management and IT Governance), TC268/SC1/WG4 (sustainable cities and communities), EIP-SCC (European Innovation Platform - Smart Cities and Communities) |
27701:2019 IS Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines
Editor |
Alan Shipman, Oliver Weissmann, Srinivas Poosarla, Heung Youl Youm |
Scope |
This document specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization. In particular, this document specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors processing PII within an ISMS. Excluding any of the requirements specified in clause 5 of this document is not acceptable when an organization claims conformity to this document. |
Documentation | https://www.iso.org/standard/71670.html |
Calendar |
|
Comments |
Was initially ISO/IEC 27552. Was renamed to ISO/IEC 27701 in August 2019 A second version is underway with a title change: Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance |
29100:2011 IS Privacy framework
Editor |
Stefan Weiss Revision : Nat Sakimura, Jan Schallaboeck |
Scope | This International Standard provides a framework for defining privacy control requirements related to personally identifiable information within an information and communication technology environment.This International Standard is designed for those individuals who are involved in specifying, procuring, architecting, designing, developing, testing, administering and operating ICT systems. |
Documentation | Is a free standard : see http://standards.iso.org/ittf/PubliclyAvailableStandards/index.html |
Comments |
|
29101:2018 IS Privacy architecture framework
Editor |
Stefan Weiss and Dan Bogdanov, For revision: Nat Sakimura, Shinsaku Kiyomoto |
Scope |
This International Standard describes a privacy architecture framework that
This International Standard is applicable to entities involved in specifying, procuring, architecting, designing, testing, maintaining, administering and operating ICT systems that process PII. It focuses primarily on ICT systems that are designed to interact with PII principals. |
Documentation | https://www.iso.org/standard/75293.html |
Comments | Revision initiated in Berlin (November 2017) |
29134:2017 IS Guidelines for Privacy impact assessment
Editor | Mathias Reinis |
Scope |
This Standard establishes guidelines for the conduct of privacy impact assessments that are used for the protection of personally identifiable information (PII). It should be used by organizations that are establishing or operating programs or systems that involve the processing of PII, or that are making significant changes to existing programs or systems. This International Standard also provides guidance on privacy risk treatment options. Privacy Impact Assessments can be conducted at various stages in the life cycle of a programme or systems ranging from the prelaunch phase and decommissioning. In particular, it will provide a framework for privacy safeguarding and specific method for privacy impact assessment. It will be applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations and will be relevant to any staff involved in designing or implementing projects which will have an impact on privacy within an organization, including operating data processing systems and services and, where appropriate, external parties supporting such activities. This Standard describes privacy risk assessment as introduced by ISO/IEC 29100:2011. For the basic elements of the privacy framework and the privacy principles, reference is made to ISO/IEC 29100:2011. For principles and guidelines on risk management, reference is made to ISO 31000:2009. |
Documentation | https://www.iso.org/standard/62289.html |
Calendar | Published in June 2017 |
Comments |
29151:2017 - Revision underway - IS Code of Practice for PII Protection (also a ITU document - ITU-T X.1058)
Editor | Heung Youl Youm, Alan Shipman Editors for revision: Heung Youl Youm, Alan Shipman, Erik Boucher, Sungchae Park |
Scope |
This International Standard establishes commonly accepted control objectives, controls and guidelines for implementing controls, to meet the requirements identified by a risk and impact assessment related to the protection of Personally Identifiable Information (PII). In particular, this International Standard specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for processing PII which may be applicable within the context of an organization's information security risk environment(s). This International Standard is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which process PII, as part of their information processing. |
Documentation |
March 3rd presentation made by editor during an informal confcall with Dawn Jutla (OASIS) and Antonio Kung (PRIPARE): http://ipen.trialog.com/wiki/File:X.gpim-29151_oasis.pdf |
Calendar |
|
Comments | Also an ITU reference (ITU-T X.gpim) |
29184:2020 IS Online privacy notices and consent
Editor |
Nat Sakimura, Srinivas Poorsala, Jan Schallaboeck |
Scope |
This document is a specification for the content and the structure of online privacy notices as well as the process of requesting consent to collect and process PII from a PII principal. This document is applicable to all situations, where a PII controller or any other entity processing PII interacts with PII principals in any online context. |
Documentation | https://www.iso.org/standard/71678.html |
Calendar |
|
Comments |
initiated in Jaipur (Oct 2015) Follows Study Period initiated in Kuching (May 2015) User friendly online privacy notice and consent |
29190:2015 IS Privacy capability assessment model
Editor | Alan Shipman |
Scope |
This International Standard provides organizations with high-level guidance about how to assess their capability to manage privacy-related processes. In particular, it:
|
Documentation | https://www.iso.org/standard/45269.html |
Calendar | |
Comments |
29191:2012 IS Requirements for partially anonymous, partially unlinkable authentication
Editor |
Kazue Sako (NEC) |
Scope |
This International Standard defines requirements on relative anonymity with identity escrow based on the model of authentication and authorization using group signature techniques. This document provides guidance to the use of group signatures for data minimization and user convenience. This guideline is applicable in use cases where authentication or authorization is needed. It allows the users to control their anonymity within a group of registered users by choosing designated escrow agents. |
Documentation | https://www.iso.org/standard/45270.html |
Comments |
|
31700-1:2023 IS Consumer Protection - Privacy-by-design for consumer goods and services - High level requirements
Editor |
Project leader: Michelle Chibba |
Scope |
Specification of the design process to provide consumer goods and services that meet consumers’ domestic processing privacy needs as well as the personal privacy requirements of Data Protection. In order to protect consumer privacy the functional scope includes security in order to prevent unauthorized access to data as fundamental to consumer privacy, and consumer privacy control with respect to access to a person’s data and their authorized use for specific purposes. The process is to be based on the ISO 9001 continuous quality improvement process and ISO 10377 product safety by design guidance, as well as incorporating privacy design JTC1 security and privacy good practices, in a manner suitable for consumer goods and services |
Documentation | See https://www.iso.org/standard/76402.html |
Calendar |
|
Versions |
|
Comments |
Note that this is an ISO standard managed by the PC 317 technical committee that is chaired by Jan Schallaboek Further to the Seventh meeting, a proposal was made to provide a technical report on use cases. 31700 would be changed into a multipart standard ISO 31700-1 Privacy-by-design for consumer goods and servives - high level requirements ISO 31700-2 Privacy-by-design for consumer goods and servives - use cases
see launch event : https://www.eventbrite.co.uk/e/launch-event-iso-31700-privacy-by-design-for-consumer-goods-and-services-tickets-488718479127 |
31700-2:2023 TR Consumer Protection - Privacy-by-design for consumer goods and services - Use cases
Editor |
Project leader: Michelle Chibba Draft provided by AhG use cases: Antonio Kung (Ahg Convenor), Rae Dulmage, Peter Esisenegger, Gail Magnusson, Rusne Juozapaitene, Dorotea de Marco |
Scope |
This document provides suggestions on how to use ISO 31700-1 as well as use cases illustrating the application of ISO 31700-1. The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of digitally enabled consumer goods and services. |
Documentation | See https://www.iso.org/standard/76402.html |
Calendar |
|
Versions |
|
Comments |
Includes 3 use case: on-line retainling, fitness company, and smart locks. Note that the last two use cases are IoT use cases see launch event : https://www.eventbrite.co.uk/e/launch-event-iso-31700-privacy-by-design-for-consumer-goods-and-services-tickets-488718479127 |
Standards in development
5181 IS Security and privacy - Data provenance
Editor | Ryan Ko, Jan de Meer, Yi Zhang |
Scope |
This document provides guidelines, methodology and techniques for deriving securely information called meta-data, from sources, intermediaries and users creating, manipulating, and transforming data. The meta-data derived from data creations and transformations serves for earning trust in entities and stakeholders during the whole lifecycle of data use and data manipulations. By referring to provenance meta-data an information respectively a decision base is provided to processes or, to individuals. Provenance meta-data of data records can also be applied from both, processes, or individuals when they have to decide which one of their data, they want to make voluntarily available to the public as a common good and which one not. |
Documentation | https://www.iso.org/standard/80971.html |
Calendar | Started in February 2023 |
Comments | Follow-up of PWI 5181 Data provenance
|
27091 IS Cybersecurity and privacy - Artificial Intelligence - Privacy Protection
Editor | Lenora Zimmerman, Antonio Kung, Byoung-Moon Chin |
Scope |
This document provides guidance for organizations to address privacy risks in artificial intelligence (AI) systems and machine learning (ML) models. The guidance in this document helps organizations identify privacy risks throughout the AI system lifecycle, and establishes mechanisms to evaluate the consequences of and treat such risks. This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations that develop or use AI systems. |
Documentation | https://www.iso.org/standard/56582.html |
Calendar | Project started in February 2023 |
Comments | Follow-up of PWI 6089 Impact of Artificial Intelligence on Security and Privacy
Is also the counterpart of ISO/IEC 27090 Cybersecurity and privacy — Artificial Intelligence — Guidance for addressing security threats and failures in artificial intelligence systems (under development)
|
27403 IS Security techniques - ioT security and privacy - Guidelines for IoT domotics
Editor |
Qin QIu, Yanghuichen Lin, Luc Poulin |
Scope |
This proposal provides guidelines to analyse security and privacy risks and identifies controls that need to be implemented in IoT domotis systems |
Documentation | https://www.iso.org/standard/78702.html |
Calendar |
Started in Paris October 2018 with a preliminary version
|
Comment | Is a WG4 project |
27562 IS Privacy guidelines for Fintech services
Leaders | Heung Youl Youm, Janssen Esguerra |
Objective |
This document provides guidelines on privacy for Fintech services. It identifies all relevant business models and roles in consumer-to-business relation as well as in business-to-business relation, privacy risks, and privacy requirements, which are related to Fintech services. It also considers regulatory requirements, such as those from anti-money laundering, fraud detection, and countering terrorist financing. It provides privacy controls specific to Fintech services to address the privacy risks, taking in consideration the legal context of the respective business role. The principles are based on the ones described in ISO/IEC 29100 and ISO/IEC 27701 and privacy impact assessment framework described in ISO/IEC 29134 and ISO 31000. It also provides guidelines focussing a set of privacy requirements for each stakeholder. This document can be applicable to all kinds of organisations such as regulators, Institutions, service providers and product providers in the Fintech service environment. |
Documentation | https://www.iso.org/standard/80395.html |
Calendar |
|
Comments |
It the result of the study period privacy guidelines for Fintech services |
27565 IS Guidance on privacy preservation based on zero-knowledge proofs
Leaders |
Bingsheng Zhang, Patrick Curry, Srinivas Poosarla |
Objective |
This document provides guidelines on using zero knowledge proofs (ZKP) to improve privacy by reducing the risks associated with the sharing or transmission of personal data between organisations and users by minimizing the information shared. It will include several ZKP |
Documentation | https://www.iso.org/standard/80398.html |
Calendar |
|
Comments |
It the result of PWI 7758 Guidance on privacy preservation based on zero knowledge proofs |
27566-1 IS Age assurance - Part 1: Framework
Leaders |
Tony Allen, Denis Pinkas, Mark Svancarek |
Scope |
This document establishes core principles, including privacy and security, for the purpose of enabling age-related eligibility decisions |
Documentation | https://www.iso.org/standard/88143.html |
Calendar |
|
Comments |
It the result of PWI 7732 Age verification |
27566 IS Age assurance - Part 3: Benchmarks for benchmarking analysis
Leaders |
Tony Allen, Denis Pinkas, Mark Svancarek |
Scope |
This document provides guidelines for interoperability, technical architecture and use of age assurance systems. |
Documentation | https://www.iso.org/standard/88147.html |
Calendar |
|
Comments |
It the result of PWI 7732 Age verification |
27706 IS Requirements for bodies providing audit and certification of privacy information management systems
Editor | Kimberly Lucy, Fuki Azetsu, Gigi Robinson | |
Scope |
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006-1. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. The requirements contained in this document need to be demonstrated in terms of competence and reliability by any body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes. | |
Documentation | https://www.iso.org/standard/82894.html | |
Calendar |
| |
Comments |
Follow-up of ISO/IEC 27006-2 TS |
Active Preliminary Work Items
PWI 7709 Security and privacy reference architecture for multi-party data fusion and mining (Started in April 2021)
Leaders |
Xiaoyuan Bai, Jin Peng |
Objective |
This document provides the followings:
|
Documentation | |
Calendar |
|
Comments |
Is a WG4 project |
PWI 27045 Big data security and privacy - guidelines for data security management framework (Started in April 2021)
Editor |
Xiaoyuan Bai - Hongru Zhu - Vicky Hailey - Shiqi Li - Liu Dapeng |
Scope |
This document provides a data security management framework that helps organizations to build the data security capabilities in the context of big data including guidelines to develop security measures. This document is applicable to all organizations, regardless of type, size or nature, that develop or use big data systems. |
Documentation | https://www.iso.org/standard/63929.html |
Calendar |
|
Comments |
Is a WG4 project. An initial projects was started in October 2018 on processes with a different scope:
It seems that the project will focus on security only |
PWI 27046 Big data security and privacy - Implementation guidelines (restarted in April 2023)
Editor | Le Yu, Victoria Hailey, Jinghua Min |
Scope |
This proposal aims to analyze challenges and risks of big data security and privacy, and proposes guidelines for implmentation of big data secuirty and privacy in aspects of big data resources, and organizing, distributing, computing and destroying big data |
Documentation | https://www.iso.org/standard/78572.html |
Calendar |
|
Comments | Is a WG4 project |
PWI 27564 Privacy models (Started in October 2021)
Leaders |
Yod Samuel Martin, Antonio Kung, Jonathan Fox, Michelle Chibba |
Objective |
Scope: PWI will study the value of specifying and maintaining privacy models Tasks:
|
Documentation |
|
Calendar |
|
Comments |
Initiated as a result of the H2020 project PDP4E
|
27566 IS Age assurance - Part 2: Interoperability, technical architecture and guidelines for use
Leaders |
Tony Allen, Denis Pinkas, Mark Svancarek |
Scope |
This document provides guidelines for interoperability, technical architecture and use of age assurance systems. |
Documentation | |
Calendar |
|
Comments |
It the result of PWI 7732 Age verification |
PWI 27568 Security and privacy of digital twins (Started in October 2022)
Leaders |
Antonio Kung, Srinivas Poosarla, Heung Youl Youm, Mark Lizar, Vitor Jesus, Vishnu Kanhere, Patrick Curry, Karim Tobich |
Objective |
The PWI will monitor the progress in standardisation work on digital twins and investigate stakeholders concerns on the security and privacy of digital twins. A call for contributions will circulated to SC 27/WG 5, and liaison will take place with SC41. A report and recommendation for further work will be prepared for discussion in the next meeting. |
Documentation |
|
Calendar |
A first report was provided at the April 2023 meeting. A second report was provided at the October 2023 meeting. |
Comments |
Needs to liaise with on-going work in ISO/IEC JTC 1/SC 41 IoT and digital twins |
PWI 27573 Privacy protection of user avatar and system avatar interactions in the metaverse (Started in October 2024)
Leaders |
Hoon Jae Lee, Hee Bong Choi, Rusne Juozapaitiene, Dae-Ki Kang, Vishnu Kanhere, Antonio Kung |
Objective |
The necessity for a section on considerations regarding personal information in Metaverse standards and Specifications is emphasized. This is due to the direct impact on personal information by PII (Personally Identifiable Information) or related data subject information identification mechanisms. MSPA (Meta Standard Privacy Assessment) is utilized as a methodology for evaluating the impact on personal information, reviewing the necessity of introducing privacy protection or controls by assessing privacy protection requirements and potential threats in standards or specifications. This process also aids in analyzing and documenting potential damages that may occur to individuals. This document contains a framework for protecting personal information during interactions between user avatars and system avatars in the Metaverse. It shall specify the requirements for:
|
Documentation |
|
Calendar |
Started in April 2024 |
Comments |